A pandemic is not defined by the severity of the illness, but by the geographical spread. Even though the spread of COVID-19 appears to be slowing in China, more than 80,000 people have been diagnosed in China and there have been reported cases in more than 80 countries, with particularly large numbers in Iran, South Korea and Italy. Australia continues to report new cases, although resulting deaths thankfully remain very low. There are considerable concerns that COVID-19 will continue to spread to people who have had only a remote connection with anyone who has travelled to China, South Korea, Japan, Italy or Iran. Global markets have dropped over the past few weeks amid growing concerns about the spread of COVID-19 that could increasingly disrupt supply chains, particularly in China. Further decline in demand for many goods and services, such as air travel, consumer goods and commodities, is expected. In Australia, the ASX200 has fallen 10 per cent in the past week, and some organisations have experienced a downturn in shares of up to 38 per cent.

An organisation can be impacted in a number of ways: absences of staff, absences of external service providers, and disruption to travel arrangements which may affect the ability of staff and supplies to reach the office. When attempting to predict the number of people who may become sick or forced to remain in quarantine, we must not forget the impact extending beyond each individual: many sick people will need someone to stay home and care for them, which can further impact healthy staff with caring obligations for children and other family members. The resultant absences from work will affect businesses and travel.

What is a Business Continuity Plan?

If a Risk or Compliance Manager were asked several years ago what constituted a business continuity plan, the usual response would relate to “disaster recovery” as a result of computer systems crashing –an event which would be fixed by their IT team. Over the last 12 months, we have been exposed to far greater threats with drought and bushfires impacting entire communities and affecting the most basic commodities such as water and electricity supplies. COVID-19 is yet another threat to be factored in.

A Business Continuity Management (BCM) Plan is designed to ensure that critical functions can be maintained or restored in a timely fashion in the event of a material business disruption. The BCM Plan should minimise the financial, legal, reputational and other consequences arising from the disruption. A robust BCM Plan must address foreseeable risks that could disrupt the organisation’s operations, and:

• ensure the continuity of services to clients and investors
• continue the provision of a safe working environment for all staff, contractors and external service providers
• provide clear communication to all staff, contractors and external service providers.

Business continuity management is an integral part of an effective enterprise risk management program and is an essential element of good governance. If an organisation does not have a workable BCM Plan and there is a significant disruption to the provision of its services, there is a high probability of increased complaints, incidents or breaches, and potential legal action against the organisation as a result of any damage or loss caused to clients and investors.

While a BCM Plan should consider all foreseeable disruption events, here we will focus on those relating to COVID-19.

What Should an Organisation Do?

The first step is to identify the elements and likely impact of the potential disruption. While the news and formal medical advice about COVID-19 appear to change almost daily, there will be a number of relatively foreseeable elements.

At the extreme end, in the event of an organisation having to close for an extended period of time due to staff illnesses and/or quarantine requirements, the same provisions can be applied as when an organisation is closed due to natural disaster, a chemical spill or even asbestos contamination that makes buildings unsafe to enter. Under those circumstances, staff must be given the option to work remotely, either at another site or at home, where reasonably possible and practical to do so. Organisations will need to have the infrastructure in place to facilitate these arrangements ahead of time, including portable laptops, mobile phones, and internet access as a minimum, while enabling staff to work in a safe and sterile location.

Some questions for organisations to consider:

• Does our organisation have any other sites to which staff can be temporarily relocated?
• Does our organisation allow for flexible work arrangements, and do we have a Working From Home policy that staff have signed?
• Where staff work from home, are they provided with company devices or do they use their own devices (BYOD); do devices contain adequate software protection, and access to internal secure servers?
• What happens to staff from rural or remote areas where internet may be unreliable or non-existent?
• How will our organisation manage activities that for practical or security reasons cannot be undertaken remotely, such as inspections of assets, access to secure internal servers, and completing transactions?

It is likely that regulatory authorities will provide advice or direction to organisations in these areas. The same planning regarding facilities should be applied if only some staff cannot attend work, whether they are in quarantine, or have caring obligations for children or other family members.

An organisation will also need to consider the impact on services or products it provides or is contracted to receive if staff are unable to perform work. For example, if 30 per cent of staff are unable to work, how will this affect the services that the organisation provides? What if 60 per cent of staff are unable to work? An organisation should consider those scenarios and consider the following:

• If staff resources are limited, which services will be given priority?
• Who are the key staff involved in the provision of services, and what should happen if they are not available to work?
• Which services would be suspended? Would there need to be alternative services in place?
• What communication should be ready for transmission to inform clients of limited services?
• Would there be contractual issues in not providing certain services?
• Are there any suppliers who would need to be notified to reduce or delay deliveries?

If the organisation is closed:

• Does that mean that some staff may not be required to work, for example facilities support staff?
• How will this be addressed? Should they be placed on paid leave, or forced to take annual or long service leave? What if they do not have the necessary leave available?
• Would the organisation consider extending paid personal/carer leave entitlements?
• If a staff member is forced to stay away from the organisation because it is closed, is this a breach of the relevant staff member’s contract of employment?
• How will client and investor fees and charges be impacted if the organisation is closed and the usual range of services cannot be provided?

At the most extreme end, if staff die from the virus, is the organisation prepared in terms of mourning and bereavement support? Does the organisation have a current Critical Incident Management Plan and policies that are part of, and informed by, the BCM Program? Losing staff directly affects organisations and their clients in other ways –it affects resourcing as well as the provision of services to clients and investors.

Summary

It is often said to expect the best, but plan for the worst. While we may be fortunate and COVID-19 could run its course relatively quickly like previous influenza outbreaks, organisations must think seriously and promptly about the possible risks it poses, and how the organisation will address them while minimising the impact on all stakeholders.

Authors

Hugh Bortolotti – Senior Associate

Hugh is a Senior Associate in our Corporate and Financial Services team in Sydney. Hugh holds a Bachelor of International and Global Studies and a Juris Doctor, both from the University of Sydney. He has spent 5 years working in Banking and Finance, and worked in Commercial Law prior to joining CompliSpace.

Svetlana Pozydajew – Senior Consultant

Svetlanais a Senior Consultant at CompliSpace. She has over 20 years of experience in strategic and operational human resource management, occupational health and safety, and design and implementation of policies and change management programs.

She has held national people management responsibility positions in the public and private sectors, and is now the content specialist at CompliSpace for harmonised WHS (and OHS in the other two States), HR, and general compliance matters for not for profits.

She holds a LLB , Masters in Management (MBA), Master of Arts in Journalism, and a Certificate in Governance for not-for-profits.